Background Details
A "control sphere" is a set of resources and behaviors that are accessible to a single actor, or a group of actors. A product's security model will typically define multiple spheres, possibly implicitly. For example, a server might define one sphere for "administrators" who can create new user accounts with subdirectories under /home/server/, and a second sphere might cover the set of users who can create or delete files within their own subdirectories. A third sphere might be "users who are authenticated to the operating system on which the product is installed." Each sphere has different sets of actors and allowable behaviors.
Modes Of Introduction
Architecture and Design
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Operation
Common Consequences
Scope |
Impact |
Likelihood |
Confidentiality Integrity | Read Application Data, Modify Application Data, Unexpected State | |
Observed Examples
References |
Description |
| Chain: router's firmware update procedure uses curl with "-k" (insecure) option that disables certificate validation (CWE-295), allowing adversary-in-the-middle (AITM) compromise with a malicious firmware image (CWE-494). |
| PHP-based FAQ management app does not check the MIME type for uploaded images |
| Some image editors modify a JPEG image, but the original EXIF thumbnail image is left intact within the JPEG. (Also an interaction error). |
Vulnerability Mapping Notes
Justification : This CWE entry is a Class and might have Base-level children that would be more appropriate
Comment : Examine children of this entry to see if there is a better fit
Submission
Name |
Organization |
Date |
Date release |
Version |
CWE Content Team |
MITRE |
2008-04-11 +00:00 |
2008-04-11 +00:00 |
Draft 9 |
Modifications
Name |
Organization |
Date |
Comment |
Eric Dalci |
Cigital |
2008-07-01 +00:00 |
updated Time_of_Introduction |
CWE Content Team |
MITRE |
2008-09-08 +00:00 |
updated Relationships, Other_Notes |
CWE Content Team |
MITRE |
2008-10-14 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2009-10-29 +00:00 |
updated Background_Details, Other_Notes |
CWE Content Team |
MITRE |
2010-02-16 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2010-12-13 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2011-06-01 +00:00 |
updated Common_Consequences |
CWE Content Team |
MITRE |
2011-06-27 +00:00 |
updated Common_Consequences |
CWE Content Team |
MITRE |
2012-05-11 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2014-07-30 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2015-12-07 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2017-11-08 +00:00 |
updated Modes_of_Introduction, Relationships, Relevant_Properties |
CWE Content Team |
MITRE |
2019-06-20 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2020-02-24 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2022-04-28 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2022-10-13 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2023-04-27 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2023-06-29 +00:00 |
updated Mapping_Notes |
CWE Content Team |
MITRE |
2024-02-29 +00:00 |
updated Demonstrative_Examples, Observed_Examples, Relationships |